Three Critical Password Reset Flaws Expose 22,000 Exchange Servers

Three critical vulnerabilities disclosed this week share a common weakness: password reset logic that fails to validate tokens properly. CVE-2026-18550 in the Nokri Job Board WordPress theme allows unauthenticated attackers to hijack admin accounts through an empty token bypass. CVE-2026-84699 in Team Password Manager permits unauthorised password resets without authentication, exposing concentrated credential stores. CVE-2026-84480 in WWBN AVideo allows permanently valid reset tokens with no expiry. Meanwhile, Shadowserver Foundation confirms 22,000 Microsoft Exchange servers remain unpatched against CVE-2026-62911, an authentication bypass allowing unauthenticated mailbox access. This episode examines why account recovery flows represent a systemic weak point in authentication systems, how attackers exploit reset endpoints that lack proper validation, and what UK small businesses should verify with IT providers about password reset security across their entire technology estate.

Chapters

• Introduction Corrine introduces three critical vulnerabilities, all rated CVSS 9.8, that share a common pattern: password reset logic failures that allow attackers to bypass authentication.
• Three CVEs, One Pattern Detailed examination of CVE-2026-18550 affecting Nokri Job Board theme with empty token bypass, CVE-2026-84699 in Team Password Manager allowing unauthenticated password resets, and CVE-2026-84480 in AVideo with non-expiring reset tokens and no available patch.
• Call to Action Listener engagement request to follow the show, leave reviews, and share episodes with small business operators and IT managers.
• Exchange: 22,000 Unpatched Servers Shadowserver Foundation research reveals 22,000 Microsoft Exchange servers remain vulnerable to CVE-2026-62911, an authentication bypass allowing unauthenticated mailbox access. Guidance on obtaining written patch confirmation from IT providers.
• The Actual Problem With Account Recovery Analysis of why account recovery flows consistently represent the weakest authentication point, how reset endpoints are treated as afterthoughts during development, and why attackers systematically target them with high success rates.
• What Your Business Should Do Now Five specific actions for the week: audit WordPress installations, verify Team Password Manager versions and rotate credentials, mitigate AVideo exposure, obtain written Exchange patch confirmation, and question IT providers about account recovery security verification across all systems.
• Closing Concluding reflection that password reset is a trust mechanism requiring verification and maintenance, otherwise becoming the easiest entry point for attackers.

Links

• https://nvd.nist.gov/vuln/detail/CVE-2026-18550
• https://nvd.nist.gov/vuln/detail/CVE-2026-84699
• https://nvd.nist.gov/vuln/detail/CVE-2026-84480
• https://nvd.nist.gov/vuln/detail/CVE-2026-62911
• https://www.shadowserver.org/